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(71) We, Smiths Industries Limited, 
a British Company of Cricklewood Works, 
London, N.W.2, and Chubb & Son's Lock 
and Safe Company Limited, a British Com- 
pany of 14—22 Tottenham Street, London, 
W.l, do hereby declare the invention, for 
which we pray that a patent may be granted 
to us, and the method by which it is to be 
performed, to be particularly described in and 
by the following statement : — 

This invention relates to access-control 
equipment and item-dispensing systems in- 
cluding such equipment. 

The invention is especially concerned with 
access-control equipment of the kind that 
selectively enables access to a facility, under 
control of an information-bearing token. 
The token, for example, may be in the form of 
a punched or embossed card, and in these 
circumstances each person authorized to make 
use of the facility may be issued with such a 
card for presentation to the equipment when 
access is required. 

According to the present invention, access- 
control equipment for selectively enabling 
access to a facility, comprises first means for 
receiving an information-bearing token pre- 
sented thereto by a person seeking access to 
said facility, second means for deriving from 
the received token a read-out of informaton 
borne thereby, third means for detecting 
whether the received token complies with a 
predetermined criterion of valid access, 
fourth means which is operable to enable 
access to said facility and which is arranged to 
be operated in this respect in dependence upon 
the information of said read-out and only in 
the event of detection by said third means that 
™ token complies with said criterion, and 
firth means that is arranged to transport the 



received token from said second means to 
return it to said person only in the event that 
said third means detects that the token com- 
plies with said criterion, and otherwise to 
transport the token from said second means 
for retention out of reach of said person. 

The predetermined criterion of validity may 
involve the existence on the token of a pre- 
determined magnetic characteristic, and in 
particular the said third means ma3' be ar- 
ranged to detect whether the token carries a 
predetermined magnetic recording. 

Alternatively, or in addition, the said pre- 
determined criterion may involve information 
of the read-out derived from the token, and 
may relate, for example, to the expiry date of 
the token. The said third means in these latter 
circumstances may be arranged to detect from 
expiry-date information contained in the 
read-out derived from the token, whether the 
token is still m force, and the said fifth means 
may then be arranged to return the token only 
in the event that this 'in-force* characteristic 
is detected. 

The equipment may include means that is 
operable manually for entering into the equip- 
ment a plural-character word, the particular 
word entered being dependent upon manual 
selection, and in these circumstances it may 
be arranged that the said fourth means is 
operable to enable access only in the event 
that there is a predetermined correspondence 
oetween the said information read from the 
token and the word entered into the equip- 
ment manually. 

The said second means for deriving a read- 
out of information from the token may in- 
clude means for providing a record of the 
token-information, and in these circumstances 
operation of said fourth means to enable 80 
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access may be arranged to be dependent upon 
the information as read from the record rather 
than directly from the token. For example, 
where the token carries information encoded 
5 in the form of embossings, the operation of 
said fourth means may be arranged to be 
dependent upon the information as read by a 
photoelectric reader from an imprint of the 
embossings made in ink on paper tape or 

JO other record material. 

The access-control equipment may be 
arranged to enable selectively, access to anv 
form of facility, and in this context the word 
'facility* as used throughout this specification, 

15 including the claims, is to be understood as 
referring to something which serves to pro- 
mote an action, operation, transaction or 
course of conduct, or which is installed or 
established to perform some particular func- 

20 tion or serve some particular purpose. More 
especially, and by way of example, the access- 
control equipment may be involvedin control 
of entry to a restricted area, use of a service, or 
release of means enabling withdrawal of an 

25 item or product in predetermined or selected 
quantity. 

One notable application of the equipment 
is in the field of banking where a money- 
dispensing system is provided for use by 

30 customers at all times, the customers being 
issued with individual coded-tokens for 
presentation to any one of a plurality of 
money-dispensing terminals of the system 
when withdrawal of money is required. The 

35 equipment of the present invention in this 
latter connection may be arranged to control 
a money-dispenser so that money (for ex- 
ample, in bank-note form) is dispensed to the 
customer in response to each, valid 'request' 

40 for withdrawal, a valid 'request* in this con- 
text involving, at least, presentation to the 
equipment of an authentic token. 

According to a feature of the present in- 
vention, an item-dispensing system comprises 

45 means providing an entrance to the system 
for a coded token presented thereto by a 
person seeking operation of the system, token- 
reading means spaced from said entrance, 
a token -transport arrangement which is for 

50 transporting a token admitted to the system 
through said entrance to the token-reading 
means and which is operable to transport the 
token from the token-reading means^ selec- 
tively to said entrance for return to said per- 

55 son or to a position within said system out of 
reach of said person, said token-reading 
means being arranged to derive from the token 
transported thereto a read-out of information 
encoded on the token, means operable man- 

60 ually for entering a number into the system, 
the particular number entered being de- 
pendent upon manual selection, item-dis- 
pensing means that is selectively operable to 
dispense from a reserve of items at least one 

65 such item upon each operation of the item- 



dispensing means, comparison means ar- 
ranged to compare a number dependent upon 
the information of said read-out with the said 
number entered into the system to operate 
said item-dispensing means to dispense at 70 
least one of said items as aforesaid in de- 
pendence upon whether a predetermined 
correspondence exists between the compared 
numbers, and detector means which is for 
detecting whether the received token com- 75 
plies with a predetermined criterion of token- 
validity and which is arranged to inhibit 
operation of the said item-dispensing means 
in the event that the token does not comply 
with said criterion, the arrangement being 80 
such that the transport arrangement is 
operated to return the token to said entrance 
only in the event that the token is detected as 
complying with said criterion, and otherwise 
to transport the token to said position out of 85 
reach of said person. 

An item-dispensing system in accordance 
with the present invention will now be de- 
scribed, by way of example, with reference 
to the accompanying drawings, in which:— 90 

Figure 1 shows the form of a coded token 
used with the item-dispensing system; 

Figure 2 is a schematic representation of 
part of the item-dispensing system used for 
receiving and selectively admitting coded 95 
tokens to the system; 

Figure 3 is a generalized schematic re- 
presentation of electronic circuits forming 
part of the item-dispensing system and used 
in conjunction with the arrangement of 100 
Figure 2; 

Figures 4 and 5 illustrate for the purposes 
of explaining the operation of encyphering 
equipment forming part of the system, alter- 
native circuit interconnections of a shift- J 05 
register; and . 

Figure 6 is a schematic representation of 
encyphering equipment as used in the ar- 
rangement of Figure 2. 

The system to be described is for use in 110 
dispensing packets of bank-notes, one at a 
time, to customers of a bank, and is for use 
after, as well as during, normal banking 
hours. The customers authorized to use the 
system are each issued with a coded token 115 
in the form of a plastics card that may be 
used generally as a credit card.^ Each card 
bears a date of expiry and numerical informa- 
tion identifying the account of the customer 
to whom the card has been issued, and this 120 
information, as well as being embossed 
directly on the card, is embossed thereon in 
coded form. The customer is informed of a 
secret, personal-identification number that is 
individual to his account but cannot be 125 
deduced from the card itself. When the 
customer wishes to withdraw a packet of 
bank-notes, he simply presents his card to a 
card-reception unit of the system at a branch 
of the bank, and operates a set of ten push- 130 
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buttons in accordance with his personal- 
identification number. The system records 
the information from the card for accounting 
and auditing purposes, and in return auto- 
5 matically dispenses to the customer one 
packet of bank-notes. The packet of bank- 
notes is dispensed to the customer from a 
dispenser that is individually associated with 
the card-reception unit and holds a supply of 
10 such packets, the dispenser being released to 
dispense the packet only after the validity of 
the transaction has been checked. In this 
respect the system checks the authenticity of 
the card, and then that the number entered 
15 manually by the customer is the number 
appropriate to the account identified by the 
card, that the card is still in force, and that ' 
the customer's account can accommodate the 
withdrawal. These latter checks are carried 
20 out at a central station or 'computer centre' 
that is common to a series of terminals' that 
each involve a card-reception unit and asso- 
ciated dispenser; the terminals may readily 
be located at different, widely-spaced branches 

25 of the bank. 

Information relating to the status of 
account of each bank customer issued with a 
card, is stored at the computer centre to- 
gether with the secret personal-identification 

30 numbers . appropriate to these accounts. 
Communication between the computer centre 
and the card-reception units at the different 
terminals is made by means of binary-coded 
signals transmitted via a conventional form 

35 of data link. Generally-speaking the encoding 
of the signals transmitted over the data link 
in respect of any transaction is conventional, 
there being special steps taken for security 
purposes to encypher one signal only 

40 namely, a signal that is transmitted from the 
computer centre to the relevant terminal in 
order to signify approval of release of the 
dispenser to dispense a packet of bank-notes. 
When a customer at any terminal is dis- 

45 pensed a packet of bank-notes, his account 
as recorded at the computer centre is debited 
with the amount of the withdrawal. The 
card-Teception unit at the terminal then acts 
to return the card to the customer for further 

50 use as desired. The card used is not returned 
(and no dispensing of course takes place) 
however, in the event that it is not authentic^ 
or has expired or is otherwise invalid; in 
each of these circumstances the card is re- 

55 tained within the card-reception unit and is 
then recoverable by bank officials only. The 
form of authentic card issued to bank custo- 
mers is shown in Figure 1. 
Referring to Figure 1, each card is formed 

60 by a rectangular substrate 1 of opaque plastics 
material that is shielded on either face by 
transparent vinyl film. The card, which 
carries a magnetic coating 2 beneath printing 
and other artwork on its obverse face (shown 

65 in Figure 1), is embossed with die customer's 



name and account number and with the date 
of expiry of the card. The account number 
and date of expiry are also encoded on the 
card using bar-characters 3 that are embossed 
on the substrate 1 in a two-out-of-five 70 
positional code, these characters together 
with the characters of the other embossings 
all protruding from the obverse face of the 
card. Two small dark markings 4 are pro- 
vided at spaced intervals from one another 75 
across the width of the card at a designated 
leading end 5, these like the magnetic coating 
2, being provided for security purposes. 

The magnetic coating 2 on the card in- 
volves two magnetic oxides of high- and 80 
low-coerciyity respectively, the magnetic 
oxides being provided either in separate 
layers, with the layer of togh-coercivity 
material extending in a band across the width 
of the substrate 1 beneath the other layer, or 85 
as an admixture of the two materials. A 
series of pulses is recorded in the high-co- 
ercivity material, the individual pulse-record- 
ings being made at positions within the coat- 
ing 2 spaced from one another lengthwise of 90 
the card. For security purposes, the low- 
coercivity material carries a magnetic record- 
ing that extends over substantially the whole 
area of the coating 2 and serves to provide 
'noise' masking the pulse-recordings from 95 
easy detection. 

The authenticity of each card presented to 
the system is checked, firstly by detecting 
whether the card has appropriately-located 
markings 4, and then by detecting whether it 100 
carries an appropriate series of pulse-record- 
ings in the coating 2. These checks are per- 
formed by the card-reception unit represen- 
ted in Figure 2. 

Referring to Figure 2, the card-reception 105 
unit has a facia 10 that is mounted in an exter- 
nal wall of the bank, and has a readily- 
accessible mouth 11 for receiving the custo- 
mer's card. The mouth 11 within the unit 
converges to a throat-portion 12 that is nor- 110 
mally blocked at its far end by a movable 
shutter 13. An electrical solenoid 14 controls 
the shutter 13, the solenoid 14 when energized 
moving the shutter 13 upwardly against a 
spring-bias to bring a gate-aperture 15 115 
through the shutter 13, into alignment with 
the throat-portion 12. This opens the way for 
the card to pass through the portion 12 into a 
guideway 16 that leads to a card-reading cas- 
sette 17. The shutter 13 remains in this open 120 
position only so long as the solenoid 14 is 
energized, and is otherwise returned and held 
by the spring-bias in the closed position in 
which the way into the guideway 16 is com- 
pletely blocked. 125 

The customer presents his card to the card- 
reception unit by inserting the end 5 into the 
exposed mouth 11 with the coating 2 upper- 
most. The end 5 is inserted through the mouth 
11 into the throat-portion 12 to abut the 130 
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closed shutter 13. In this position of the card 
the set of markings 4 lie beneath lamps 18 
(of which only one is shown) that are con- 
tinuously energized to direct light downwardly 
5 across the throat-portion 12 for reflection 
back to individual photoelectric cells 19. 
The photoelectric cells 19 (of which only one 
is shown) are disposed at spaced intervals 
from one another across the width of the 
10 throat-portion 12, and, until a card is inserted 
in the throat-portion 12, each cell 19 receives 
light from its associated lamp 18 and in 
response thereto supplies an electric signal to 
an electrical gating unit 20. 
35 The unit 20 is responsive only to the con- 
dition in which signals are supplied by a 
certain combination of the photoelectric cells 
19 and not by the remainder. This condition 
exists only when a card with the corresponding 
20 number of appropriately-located markings 4 
is presented to the card-reception unit with 
the end 5 leading and with the coating 2 
uppermost, reflection of light to those of the 
cells 19 that are in register with the markings 
25 4 being interrupted, and to the remainder 
continuing by virtue of the absence of mark- 
ings 4 elsewhere across the width. Response 
of the gating unit 20 to this condition is, 
however, effective to produce an output signal 
30 from the unit 20 only in the circumstances in 
which an enabling signal is supplied to the 
unit 20 from the dispenser 21 of the terminal. 
The dispenser 21 supplies the enabling signal 
to the unit 20 only so long as there is still a 
35 packet of bank-notes available therein. If 
no enabling signal is supplied from the dis- 
penser 21, there is not output signal from 
the unit 20, and an EMPTY sign (not shown) 
on the facia 10 to the card-reception unit is 
40 illuminated. The EMPTY sign is illuminated 
(by means not shown) throughout any period 
for which the enabling signal is not supplied 
by the dispenser 21, so as to warn customers 
that the system is not operative. The absence 
45 of the enabling signal from the dispenser 21 
has the effect of inhibiting operation of the 
whole system, since the system is then in- 
capable of responding even when presented 
with an authentic card. 
50 When there is response of the unit 20 in 
the presence of the enabling signal from the 
dispenser 21, the output signal supplied by 
the unit 20 is passed to switch ON a switch 
unit 22 that controls the supply of electrical 
55 energization current to the solenoid 14. The 
output signal is also supplied to switch ON a 
switch unit 23, and to start operation of two 
timers 24 and 25. The switch unit 23 controls 
the supply of electrical energization current 
60 to a reversible electric motor 26 that drives 
three card-transport rollers 27 to 29 that pro- 
ject into the guideway 16 at spaced intervals 
therealong. The switching ON of the units 
22 and 23 serves to energize both the solenoid 
65 14 and the motor 26, with the result that the 
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shutter 13 moves upwardly to admit the card 
through the gate-aperture 15 into the guide- 
way 1 6, and the rollers 27 to 29 rotate in their 
forward senses indicated by the arrows F. 
The card admitted through the gate-aperture 70 

15 is fed by the customer into the guideway 

1 6 until the leading end 5 reaches the rotating 
roller 27. An idling roller 27* is urged resili- 
ency and downwardly into contact with the 
roller 27 so that when the end 5 reaches the 75 
roller 27 the card is drawn lengthwise com- 
pletely into the card-reception unit. The 
card is drawn in between the rollers 27 and 
27 1 to be fed along the guideway 16 towards 
the rotating roller 28. The end 5 eventually 80 
enters between the roller 28 and an associated 

. pinch roller 28 1 at the entrance to the reading 
cassette 17. The card is accordingly drawn 
lengthwise from the rollers 27 and 27 1 and is 
passed further on along the guideway 16 85 
towards the rotating roller 29 positioned at 
the far end of the cassette 1 7. 

The card, in its passage along the guide- 
way 16 from the roller 27 to the roller 28, 
passes successively beneath a magnetic- 
recording head 30 and a magnetic-reading 
head 31 that both project into the guide- 
way 16. The head 30 is energized with alter- 
nating current that is suppolied from a source 
32 to erase the 'noise* which in an authentic 
card is recorded over the pulse-recordings in 
the coating Z The frequency and amplitude 
of this alternating current are so chosen that 
the magnetic flux produced by the head 30 is 
well capable of erasing the 'noise' recorded 
in the low-coercivity material, but is nonethe- 
less insufficient to affect the pulse-recordings 
recorded in the high-coercivity material. 

The erasure of the *noise' masking the 
pulse-recordings enables these recordings to 105 
be read in turn from the coating 2 by the 
head 31 as the card is fed lengthwise from the 
rollers 27 and 27 1 . The sensed pulse-record- 
ings give rise to a series of pulse signals which 
are passed from the head 31 to be counted 110 
by a code-recognition unit 33. The unit 33 
-detects whether the number of pulse signals 
counted is the same as the number of pulse- 
recordings provided on each authentic card, 
and then only if it is, provides on a lead 34 1 15 
an output signal indicative of this fact. This 
output signal, the existence of which is an 
essential for release of the dispenser 21 to 
dispense a packet of bank-notes, persists after 
the card has passed on to the roller 28 and 120 
until the unit 33 is eventually reset. 

The card in being driven by the rollers 27 
and 27 J to the roller 28 actuates a microswitch 
and this serves to energize a solenoid that 
acts via an operating fork (the microswitch, 125 
solenoid and fork are not shown) to lower the 
pinch roller 28 1 downwardly as the end 5 of 
the card reaches the roller 28 at the entrance 
to the cassette 17. The roller 28 1 is in this 
way pressed downwardly on to an inked 130 
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ribbon 35 that is fed from a supply spool 36 to 
pass between the roller 28 1 and a paper tape 
37. The tape 37, which is fed within the 
cassette 17 from a supply spool 38, is pressed 
5 under the ribbon 35 against the obverse face 
of the card in the guideway 16. As the card is 
drawn lengthwise through the rollers 28 and 
28 1 with the ribbon 35 and tape 37, so the tape 
37 is imprinted in ink with the embossings of 
10 the card. The length of ribbon 35 passed is 
taken up by a sprung arm 39 the pivoting of 
which operates a ratchet 40 to cause a very 
small fraction of this length to be wound on a 
take-up spool 41, the remainder returning to 
15 the spool 36 for use again, when the roller 28 1 
is subsequently lifted (as referred to later). 
The paper tape 37 imprinted with the em- 
bossings of the card, on the other hand, 
passes out from the cassette 17 via a photo- 
20 electric reader 42 that reads from the tape 
37 the imprint made by the bar-characters 
3 and supplies signals in accordance with the 
encoded account number and expiry date 
to a store 43. 
25 The leading end 5 of the card driven from 
between the rollers 28 and 2S 3 , enters be- 
tween the rotating roller 29 and an associated 
idling roller 29 1 that is urged downwardly and 
resiliently onto the roller 29. On passing 
30 from between the rollers 29 and 29 1 the end 
5 actuates a microswitch 44 and thereby 
causes an electric signal to be supplied to 
switch OFF the unit 22 and to terminate 
operation of the timer 24. The switching OFF 
35 of the unit 22 breaks the supply of energiza- 
tion current to the solenoid 14 with the 
result that the shutter 13 closes. The timer 
24 is arranged to supply a signal to the unit 
22 to have the same effect as this, in the event 
40 that a pre-set period of operation of the timer 
24 expires before receipt of the signal from 
the microswitch 44. In this latter respect, the 
timer 24 is pre-set to run for a period ade- 
quate to allow the card to be transported 
45 along the guideway 16 into the card-reading 
cassette 17. Operation of the timer 24 to run 
for this period is started, as referred to above, 
by the output signal from the gating unit 20 
immediately preceding admission of the card 
50 to the guideway 16. If within this period 
there is no signal from the microswitch 44 
(that is to say, if there is no signal to signify 
that the card has fully entered the cassette 17), 
then the timer 24 supplies an output signal 
55 that has the effect of inhibiting further opera- 
tion of the system. This output signal from 
the timer 24, as well as being supplied to the 
unit 22 to result in closure of the shutter 13, 
is supplied to switch OFF the unit 23 and 
60 thereby break energization of the motor 26. 
The operation of the timer 24 to produce 
this output signal is inhibited however, when 
in the normal course of events there is actua- 
tion of the microswitch 44 before expiry 
65 of the pre-set period. 



The signal supplied to the timer 24 and 
unit 22 upon actuation of the microswitch 44 
is supplied to break drive from the motor 26 
to the rollers 27 to 29, so that once the micro- 
switch 44 is actuated, drive to the card ceases. 70 
The card is restrained from movement in 
these circumstances by virtue of the pressure 
of the rollers 28 1 and 29 1 holding it against 
the stationary rollers 28 and 29. 

Operation of the timer 25, started in re- 75 
sponse to the output signal of the gating unit 
20, causes illumination of a second sign on the 
facia 10. The sign signifies ENTER PER- 
SONAL - IDENTIFICATION NUMBER, 
and illumination of this directs the customer 80 
to enter his appropriate personal-identifica- 
tion number using a set of ten push-buttons 

45 (only two of which are shown) mounted 
in four rows on the facia 10. The personal- 
identification number is in each case a deci- 85 
mal number of six digits. The ten push- 
buttons 45 are accordingly numbered with 
the ten decimal digits 0 to 9 respectively, the 

six digits of the number being entered in 
order operating one push-button 45 at a 90 
time. The six-digit number entered in this 
way is stored in the store 43 arid results in 
application of a signal to terminate operation 
of the timer 25. Termination of this operation 
causes illumination of the second sign to be 95 
extinguished and starts operation of a timer 

46 to illuminate a third sign on the facia 10, 
signifying WAIT. In addition, the informa- 
tion that is stored in the store 43 and relates 

to the customer's account number and card 300 
expiry-date read from the card via the tape 
37, is now transmitted to the computer centre 
shown in Figure 3. 

Referring to Figure 3, the information from 
the store 43 is transmitted to the computer 105 
centre together with digital representations 
of the signal appearing on the lead 34 and 
the identification number of the money- 
dispensing terminal involved. The informa- 
tion relating to the expiry date is checked in 110 
a check unit 50 at the computer centre to 
ensure that the card is still in force, whereas 
the other transmitted information is recorded 
in a recording unit 51 for accounting and 
security-checking purposes. The account 115 
nunibeT is also used at the computer centre 
to address two storage units, one a main, 
random-access storage-unit 52 that stores the 
personal-identification numbers associated 
with the respective account numbers and 120 
details of the status of each account, and the 
other a so-called hot-card storage -unit 53 
that stores the account numbers of customer's 
cards that are no longer valid (for example, 
cards that have been lost or stolen). The 125 
addressing of the main storage-unit 52 by 
the account number reveals the status of the 
account and the six-digit personal-identifica- 
tion number that is to be entered by the 
customer using the card. The number 130 
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actually entered by the customer, as stored by 
the store 43 (Figure 2), is transmitted to the 
computer centre together with a sixteen- 
digit binary cypher that is derived at the 
5 terminal by an encyphering unit 55 (Figure 2), 
the entered number being supplied to the 
storage unit 52 and the cypher to a centraL 
encyphering unit 54. In the storage unit 52 
the entered personal-identification number is 

10 compared for equality with the personal- 
identification number revealed by the account 
number identified from the terminal. If 
equality exists and the status of the account 
can accommodate withdrawal, a signal to this 

15 effect is passed from the unit 52 to the unit 54. 
(It may be useful to transmit back to the 
terminal from the unit 54 signals for use in 
giving the customer an indication of the status 
of his account; in particular it may be 

20 arranged that a sign on the facia 1 0 signifying 
ACCOUNT LEVEL LOW is illuminated in 
the event that the status of the account can 
accommodate only a few further transac- 
tions.) 

25 The encyphering unit 54 transmits to the 
terminal a signal signifying approval of the 
dispensing operation, only in response to the 
signal from the storage unit 52 and confirma- 
tion from the check carried out by the unit 50 

30 that the card at the terminal is still in force. 
This 'approval' signal is transmitted to the 
terminal in a form determined by the cypher 
received from the unit 55, and at the terminal 
is recognized by the unit 55. When recognized 

35 by the unit 55 the 'approval* signal causes the 
application of a 'dispense' signal to a gating 
unit 56 (Figure 2) that receives the signal on 
the lead 34. The 'dispense' signal at the 
terminal is passed on from the unit 56 to the 

40 dispenser 21 only in the event that the signal 
on the lead 34 signifies that the card has 
satisfied the magnetic check performed using 
the heads 30 and 31. The dispenser 21 dis- 
penses one packet of bank-notes to the 

45 customer on reception of the 'dispense* signal 
and transmits a signal signifying this to the 
storage unit 52 at the computer centre for use 
in debiting the customer's account. At the 
same time the dispenser 21 supplies a signal 

50 to terminate operation of the timer 46 and 
thereby extinguish the WAIT sign, and to 
start operation of a further timer 57. 

The timer 57 after running for a few 
seconds, acts to cause re-energization of the 

55 solenoid 14 by switching ON the unit 22, 
and re-engagement of the drive from the 
motor 26 to the rollers 27 to 29. Drive to the 
rollers 27 to 29 is re-engaged in the reverse 
sense so that the card is returned along the 

60 guideway 16 to pass through the re-opened 
shutter 13; during this reverse movement of 
the card the roller 28 1 is lifted away from the 
roller 28 so that no movement or imprinting 
of the paper tape 37 takes place (drive- 

65 pressure is maintained on the card as i t passes 



over the roller 28 at this time by small rollers 
on either side of the pinch-roller 28 1 ). A 
further sign on the facia 10 is at this time 
illuminated to signify REMOVE CARD to 
the customer. The full operatingperiod of the 70 
timer 57 is such as to give the customer ade- 
quate time to remove the returned card from 
the mouth 11 (it may be readily arranged, 
however, that the period continues to run 
until there is in fact removal of the returned 75 
card). At the end of this full period the sign 
REMOVE CARD is extinguished and a 
signal is passed from the timer 57 to switch 
OFF both units 22 and 23 so that energization 
of both the solenoid 14 and motor 26 ceases. 80 
The card-reception unit, and the terminal 
equipment as a whole, is now reset in readi- 
ness for presentation of the same or another 
card to the mouth 11. 

It has been assumed above that the *ap- 85 
provaV signal is received by the cash-dispen- 
sing terminal. No such signal is sent from 
the computer centre in the event of one or 
more of the circumstances in which (a) 
correspondence with the personal-identifica- 90 
tion number stored against the account 
number in the unit 52 is not detected, (b) the 
status of the account as recorded in the unit 
52 cannot accommodate a withdrawal, and 
(c) the unit 50 detects that the card at the 95 
terminal is no longer in force. In either of 
circumstances (a) and (b) the timer 46 runs 
for its full period; at the end of this period 
the sign WAIT is extinguished and the timer 
57 is operated to return the card to the custo- 1 00 
mer and illuminate the sign REMOVE 
CARD, in the same manner as described 
above. Another sign on the facia 10 is in this 
case illuminated with the sign REMOVE 
CARD, to signify NO DEBIT, and an elec- 105 
tromagnetically-operated hammer 58, ad- 
jacent the photoelectric reader 42, is energized 
to make an imprint on the paper tape 37 and 
thereby signify against the record of the card 
that the dispenser 21 has not been operated. 1 10 

In circumstance (c), as with circumstances 
(a) and (b), no 'approval* signal is transmitted 
to the terminal, but in this case a signal is 
transmitted from the check unit 50 to a timer 
59 at the terminal. The same signal is trans- 115 
mitted from the computer centre to set the 
timer 59 in operation in the event that the 
account number transmitted to the computer 
centre corresponds to one of the numbers 
stored in the hot-card storage unit 53. The 120 
timer 59 is also set in operation from within 
the terminal itself, in the event that the signal- 
condition of the Jead 34 indicates that the 
card has not satisfied the magnetic check 
performed using the heads 30 and 31. 125 

The timer 59 when set in operation acts to 
terminate operation of the timer 46, and after 
running for a few seconds acts to re-engage 
the motor 26 to drive the rollers 27 to 29 in 
the forward sense so that the card is driven 130 
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from within the cassette 17 into a bin 61 at 
the rear of the card-reception unit ; the card in 
the bin 61 can be retrieved by bank officials 
only, and not by the customer. At this time 
5 the timer 59 also energizes the electroroagneti- 
cally-operated hammer 58 to make an im- 
print on the paper tape 37 signifying that the 
dispenser has not been operated. In addition 
the timer 59 acts to illuminate the sign NO 

10 DEBIT concurrently with another sign on 
the facia 10 signifying CARD RETAINED. 
At the end of the full period of the timer 59, 
these two signs are extinguished and a signal 
is passed to switch OFF the unit 23 so that 

15 energization of the motor 26 ceases, the 
whole terminal equipment being now reset in 
readiness for presentation of another card to 
the mouth 11. 
Provision is made at the computer centre 

20 for giving warning of interference with, or 
malfunction of, the terminal equipment. In 
particular a signal is passed from the unit 52 
to a warning device 62 at the computer centre 
in the event that after an 'approval' signal 

25 has been transmitted from the unit 54 no 
return signal is received from the dispenser 21 
to indicate that dispensing has taken place. 
In addition the dispenser 21 transmits a 
similar signal to the device 62 in the event 

30 that there is attack on, or other interference 
with, the equipment (in particular the dis- 
penser 21) at the terminal. Provision may 
also be made for warning to be given in the 
event that the unit 52 detects that repeated 

35 attempts are being made with the same card 
to achieve operation of the dispenser 21 
using experimental personal-identification 
numbers; a signal may in these circum- 
stances be transmitted to the timer 59 so that 

40 the card is then retained. Generally-speaking 
there is continuous transmission of a signal- 
level from the terminal to the computer centre 
such that any failure in power supply at the 
terminal, or communication with the centre, 

45 will be detected immediately. 

The security of the system as regards the 
dispensing of packets of bank-notes is de- 
pendent upon the security of the 'approval' 
signal and the recognition of this at the 

50 terminal. The apparatus provided, both at 
the terminal and at the centre, to achieve 
the encyphering and recognition of the ap- 
proval signal involves a multistage shift- 
register used as a chain-code generator. 

55 Figures 4 and 5 illustrate the manner in 
which a. shift-register 65, having in this case 
three bi-stable stages only, may be used in 
this respect to provide a respective chain 
code that varies according to the feedback 

60 connections made. In the case of the arrange- 
ment shown in Figure 4 the outputs of the 
second and third stages, H and III, are added 
together (without carry) in a half-adder 66 
to provide the feedback, whereas in the case 

65 of the arrangement shown in Figure 5 it is 



the outputs of the first and third stages, I and 
III, that are added. The digit "0" or *T* fed 
back is in each case entered in the first stage 
of the register during the next pulse of the 
shift-pulse sequence on lead 67, the code 70 
sequences achieved in the two cases, starting 
from the condition in which each stage I, II 
and III is in the *T' state, are:— 

Figure 4 Figure 5 
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80 



In each case the register 65 is returned after 
seven shifts to its starting condition and so 
repeats the sequence recurrently. The con- 85 
dition of the register 65 at any particular time 
during operation depends upon three factors, 
namely, the feedback configuration, the num- 
ber of shift-pulses since commencement of 
operation, and the particular condition that 90 
existed at commencement It is on the basis 
of these three factors that encyphering of the 
'approval* signal takes place, this signal being 
generated in both the unit 55 and the unit 54 
at the terminal and computer centre respec- 95 
tively, from the cypher derived by the unit 
55. The units 55 and 54 are of substantially 
the same construction as one another, the 
only significant difference lying in the* fact 
that the unit 55 includes comparator and 100 
cypher-generating means not provided in the 
unit 54. The construction of the unit 55 is 
shown in Figure 6. 

Referring to Figure 6, the cypher-generating 
means included in the unit 55 comprises a 105 
random-number generator 70 that generates a 
random sequence of sixteen-digit binary 
numbers, and a selection unit 71 that is 
operative to select and store temporarily 
whichever number is being generated at the 110 
time when entry of the personal-identification 
number into the store 43 is completed; it is 
the number selected by the unit 71 that is 
transmitted from the unit 55 to the computer 
centre as the sixteen-digit binary cypher. The 115 
comparator means in the unit 55, on the 
other hand, is a comparator 72 that is opera- 
tive to compare the Approval 5 signal received 
from the computer centre, with a representa- 
tion of a sixteen-digit binary number genera- 120 
ted within the unit 55 using the cypher in 
conjunction with a sixteen-stage shift-reeister 
73. 

Each stage of the shift-register 73 is con- 
nected via an individual gate 74 to a binary 125 
adder 75. The adder 75 supplies feedback to 
the shift-register 73 in accordance with the 
least-significant binary digit of the sum 
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accumulated, so in this way there is generated 
through successive shifts of the register 73, a 
chain code dependent upon which of the 
gates 74 is open and which closed. The six- 
5 teen gates 74 are controlled individually by a 
feedback-programming unit 76 in accordance 
with the values, "0" or "1", of the sixteen 
binary digits of the random-number selected 
by the unit 71. Each individual gate 74 is 

1 0 controlled to be open or closed in dependence 
upon the value of a respective one of the six- 
teen digits, the particular one being dependent 
upon the particular system of jumpering, that 
is to say cross-section, effected by means of a 

15 programme card (not shown) inserted m the 
unif76. This programme card and the ran- 
dom number generated, accordingly deter- 
mine in conjunction with one another the 
particular feedback-configuration used: the 

20 same feedback-configuration is achieved in 
the unit 54 at the computer centre by using a 
duplicate of the programme card in the feed- 
back-programming unit (76) ihere, and effect- 
ing the operation of the associated feedback 

25 gates (74) in accordance with the transmitted 

cypher. . ^ . . t 

A cycle-programme unit 77 is responsive to 
the number of shifts executed by the shift- 
register 73 after the selection of a random 

30 number by the unit 71 and the consequent 
setting of the gates 74. After a programmed 
number of these shifts (for example, sixteen) 
the unit 77 responds to store the sixtecn- 
digit binary number then held by the register 

35 73^ It is with this number that comparison of 
the 'approval' signal received from the com- 
puter centre takes place in the comparator 72. 
The 'approval' signal is in fact derived at 
the computer centre from the cycle-pro- 

40 gramme unit (77) of the enciphering unit 54, 
there being duplication at this cycle-pro- 
gramme unit of the programme used at the 
unit 77 in order that the same number of 
shifts are executed by the shift-register (73) 

45 there, before response of tl.e cycle-programme 
unit. The sixteen-digit number selected and 
stored by this latter unit provides the en- 
cyphered 'approval' signal transmitted from 
the centre after the various checks carried out 

50 by the units 50 and 52 are satisfied, and this 
signal is recognized by the enciphering unit 55 
at the money-dispensing terminal only if the 
comparison effected by the comparator 72 
reveals equality of this number with the num- 

55 ber selected and stored by the unit 77. It is 
only in the event of such equality that the 
'approval' signal can give rise to the 'dispense' 
signal supplied at the terminal to the gating 
unit 56. 

60 The 'approval* number is derived at the 
computer centre from the same cypher num- 
ber as the 'comparison' number selected ar.d 
stored by the unit 77, using the same feed- 
back- and cycle-programmes, and accordingly 

65 there can be equality between the two num- 



bers only if the shift-registers at the terminal 
and centre both start with the same setting. 
The initiar setting of the shift-register 73 at 
the terminal is effected by an ^ entry-pro- 
cramme unit 78 that enters a sixteen-digit 70 
binary number into the register initially 
upon each operation of the selection unit 71. 
The unit 78 and the corresponding entry- 
programme unit at the computer centre, 
may be arranged to enter the same pro- 75 
grammed number into their respective regis- 
ters for each transaction, but it is preferred 
instead to make the entered number depen- 
dent upon the account number of the particu- 
lar card used for the transaction. The account 80 
number as read from the imprint of the card 
by the photoelectric reader 42 and stored in 
the store 43 at the terminal, is accordingly 
conveyed to the unit 78 for use there in deriv- 
ing the number to be entered. At the centre 85 
the corresponding entry-programme unit, 
working to the same programme as the unit 
78, derives the same sixteen-digit binary num- 
ber (for entry in its associated register) from 
the account number as transmitted from the 90 
store 43 to the unit 52. 

With the form of customer's card described 
above with reference to Figure 1, the pulse- 
recordings carried by the high-coercivity 
magnetic oxide of the coating 2 are masked 9:> 
by 'noise' recorded in the low-cc cavity 
magnetic oxide. Although the use of mag- 
netic-masking in this way provides an ele- 
ment of security it is certainly not an essen- 
tia!. In this latter respect, the coating 2 of 100 
the customer's card may consist of high- 
coercivity magnetic oxide alone, the pulse- 
recordings being recorded in this material 
and being read by the head 31 in checking 
the authenticity of the card, as before. 105 
Although no masking is used in these 
circumstances, the magnetic-recording head 
30 is preferably retained and energized with 
alternating current as before, since this en- 
sures that a card cannot satisfy the auihen- 110 
ticity-check unless it carries magnetic ma- 
terial of sufficiently high coercivity. This 
applies whether or not the magneric material 
on the card carries pulse recordings that would 
otherwise satisfy the check, since the action 115 
of the head 30 is to erase any recorded signal 
from material having a coercivity less than 
the predetermined, high value. 

Attention is directed to co-pending Patent 
Application Nos. 41424/68 and 41425/68 120 
(Serial Nos. 1,285,444 and 1,285,445) which 
are in the name of Smiths Industries Limited 
alone, and which include the same description 
with reference to the drawings as the present 
specification. In addition, attention is direc- 125 
ted to Patent No. 1,233,555 in the names of 
the present Applicants, and to Patent Nos. 
1,197,183 and 1,223,557 in the name of 
Smiths Industries Limited alone, which each 
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include claims relevant to the dispensing 
system described herein. 

WHAT WE CLAIM IS:— 
1. Access-control equipment for selec- 
5 tively enabling access to a facility as herein- 
before defined, comprising first means for 
receiving an information-bearing token pre- 
sented thereto by a person seeking access to 
said facility, second means for deriving from 
10 the received token a read-out of information 
borne thereby, third means for detecting 
whether the received token complies with a 
predetermined criterion of valid access, fourth 
means which is operable to enable access to 

15 said facility and which is arranged to be 
operated in this respect in dependence upon 
the information of said read-out and only in 
the event of detection by said third means 
that the token complies with said criterion, 

20 and fifth means that is arranged to transport 
the received token from said second means to 
return it to said person only in the event that 
said third means detects that the token com- 
plies with said criterion, and otherwise to 

25 transport the token from said second means 
for retention out of reach of said person. 

2. Access-control equipment according 
to Claim 1 wherein the said first means pro- 
vides an entrance to the equipment for an 

30 information-bearing token, spaced from said 
second means, and said fifth means includes 
a token-transport arrangement which is for 
transporting along a path to said second 
means any token admitted to the equipment 

35 through said entrance, and which is arranged 
to return the token from the said second 
means back along said path to said entrance 
only in the event that said third means de- 
tects that the token complies with said 

40 criterion. 

3. Access-control equipment according to 
Claim 2 wherein the token-transport arrange- 
ment is arranged to drive the token from the 
said second means in a direction opposite to 

45 that of return along said path, in the event 
that said third means does not detect that the 
token complies with said criterion. 

4. Access-control equipment according to 
Claim 2 or Claim 3 wherein said third means 

50 . includes a detector device positioned at a 
point along said path and arranged to detect 
whether the token complies with said criterion 
as the token passes said point in passage to 
the said second means. 

55 5. Access-control equipment according to 
any one of Claims 1 to 4 wherein said pre- 
determined criterion involves the existence on 
said token of a predetermined magnetic 
characteristic. 

60 6. Access-control equipment according to 
Claim 5 wherein said third means is arranged 
to detect whether the token carries a pre- 
determined magnetic recording. 
7. Access-control equipment according to 



Claim 5 wherin said third means includes 65 
means for submitting the received token to a 
magnetic erasure process for erasing magnetic 
recording from any magnetic material having 
less than a predetermined level of coercivity, 
and further means for detecting magnetic re- 70 
cording remaining" on the token after the 
token has been submitted to the erasure pro- 
cess, the arrangement being such that opera- 
tion of said fourth means is inhibited, and 
said fifth means transports the token for 75 
retention within the equipment, in the event 
that a predetermined magnetic recording is 
not detected on the token by said further 
means. 

8. Access-control equipment according to 80 
any one of the preceding claims wherein said 
third means includes means responsive to the 
information of said read-out to detect 
whether the token complies with said 
criterion by checking this information against 85 
other information retained in the equipment. 

9. Access-control equipment according to 
any one of the preceding claims including 
manually-operable means for entering into 
the equipment a plural-character word, the 90 
particular word entered being dependent 
upon manual selection, comparison means 

for detecting whether a predetermined corre- 
spondence exists between the information of 
said read-out and the manually-entered word, 95 
and means for enabling operation of said 
fourth means to enable access to said facility 
in dependence upon said predetermined corre- 
spondence being detected by the comparison 
means. jqq 

10. Access-control equipment according 
to Claim 9 wherein the arrangement is such 
that the said fifth means is operable to return 
the token irrespective of whether said corre- 
spondence is detected by the comparison 105 
means. 

11. Access-control equipment according 
to any one of the preceding claims wherein 
the said second means comprises means for 
providing from said received token a record 110 
of information borne thereby, and means for 
reading out from said record part at least of 
the recorded information. 

12. An item-dispensing system comprising 
access-control equipment according to any 115 
one of the preceding claims in combination 
with an item-dispenser for dispensing items 

in response to each operation of said fourth 
means. 

13. An item-dispensing system comprising 120 
means providing an entrance to the system 
for a coded token presented thereto by a per- 
son seeking operation of the system, token- 
reading means spaced from said entrance, a 
token-transport arrangement which is for 125 
transporting a token admitted to the system 
through said entrance to the token-reading 
means and which is operable to transport the 
token from the token-reading means selec- 
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lively to said entrance for return to stud 
person or to a position within said system out 
of reach of said person, said token-reading 
means being arranged to derive from me 
5 token transported thereto a read-out of 
information encoded on the token, means 
operable manually for entering a number jnto 
the system, the particular number entered 
bein? dependent upon manual selection, 

10 iten>dispensing means that is selectively 
operable to dispense from a reserve of items 
at least one such item upon each operation of 
the item-dispensing means, comparison means 
arranged to compare a number de- 

15 pendent upon the information of 
said read-out with the said number entered 
into the svstem to operate said item-dispensing 
means to dispense at least one of said items 
as aforesaid in dependence upon whether a 

20 predetermined correspondence exists between 
the compared numbers, and detector means 
which is for detecting whether the received 
token complies with a predetermined cri- 
terion of token-validity and which is arranged 

25 to inhibit operation of the said item-dispens- 



ing means in the event that the token does not 
complv with said criterion, the arrangement 
being such that the transport arrangement is 
operated to return the token to said entrance 
only in the event that the token is detected as 30 
complying with said criterion, and otherwise 
to transport the token to said position out or 
reach of said person. . 

14 An item-dispensing system according 
to Claim 13 wherein said detector means 35 
includes a magnetic reading head for reading 
magnetic recording from the token. 

15. An item-dispensing system according 
to Claim 14 and including equipment sub- 
stantially as hereinbefore described with re- 40 
ference to Figure 2 of the accompanying 
drawings. 

16. In a bank, an item-dispensing system 
according to any one of Claims 12 to 15, for 
dispensing money. 45 

For the Applicants, 
G. F. COLES, 
Chartered Patent Agent. 
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